Implement API Key Create/Update Endpoints

This probably doesn't represent 100% of the feature set we want (e.g. administrators cannot deactivate other users' keys), but I think it's enough to begin working on other areas.
I don't see the benefit of this style of testing over just putting both asserts in one test.  The name of the test is equivalent to a comment it seems to me.  The copy/paste bothers me.